== rock-5b-secureboot.img from rock-5b_UEFI_Release_824e6c12168a+harma.enforced.rca3b87f7.img (6446592 bytes, zero-padded to 0x7C0000)
device        rock-5b
edk2-rk3588   824e6c12168a51cf72470fb43da60642e835198f
org           harma
secure-boot   enabled
recipe        ca3b87f7
tf-a          51d8794cc2b52e8df842ab2d2b6e1326a80da735 (+ scripts/firmware/tfa-patches)
# submodules
  +51d8794cc2b52e8df842ab2d2b6e1326a80da735 arm-trusted-firmware (v2.12.0-4513-g51d8794cc)
  +1826bba6fb1c8c0b6d845f8308590dcfd1f7f859 devicetree/mainline/upstream (v7.2-dts)
  +2970e5699ba6267f3384ffab20f96647578aebc8 edk2 (edk2-stable201903-10800-g2970e5699b)
  +7ac12d81e02b323bffdf1ef3c188ea33c2185c91 edk2-non-osi (heads/master)
  +2db572db2fead29fbb4b622b0ea954b2f2f93a62 edk2-platforms (20260316-before-platform-removals-213-g2db572db2f)
  +3e288fe814e059dd06833495f845cab04ac20a5c misc/rkbin (heads/master)
# inputs (sha256)
  keys/a1117f516a32cefcba3f2d1ace10a87972fd6bbe8fe0d0b996e09e65d802a503  ms_kek.cer
  keys/48e99b991f57fc52f76149599bff0a58c47154229b9f8d603ac40d3500248507  ms_uefi_ca.cer
  keys/b75a1306efa11c2de07c64b5089c6553e1dbcfb8c04d91f90baf846f9111a82d  org_db.cer
  keys/e5e1d4126c0b34a334809b66a9f062be97f9ba5862da51e01e17edd830bebb50  org_kek.cer
  keys/d29db6216b2ab629af8c99e9bc77590579a281287e5fe109c92c80cc56515933  org_pk.cer
  8eb05757435dc6f866d0dca68dde1d6295108ff1ea09dce1271333da200b4a80  edk2-rockchip/Platform/Radxa/Drivers/LogoDxe/Logo.bmp
# patches
  9950df0fa678c0119c1544ae6714c93d6e9c0c6cd748283ec78d9118a816cbdd  0001-fit-drop-never-executed-optee.patch
  be747a990b5d34b34ae2cc01be83c5a257f3c02e3c3bb8387ad02fb8b141d143  0002-fit-bl31-rw-segment-at-mainline-address.patch
  4e563ddc6f5c18cf233b0df6a3c3d4426544eb2564315caa29c3b293dc7e8282  0003-port-to-edk2-stable202608.patch
  5b0938fccd54e7c45747eac5e939c19f37d427f7c1d4eb4e4b63303ad21ebdc2  0004-secure-boot-enroll-default-keys.patch
  b7a53b8b1e81feaf1c3c399caa3f687eed642fa81b3154123d0ea24746254184  0001-feat-rk3588-add-doorbell-interrupt-support-to-SCMI.patch
  0d120c4beaad2088349b6cdc631eca7e5d66f160a78e5fbbbcb918082169ab39  0002-feat-scmi-add-voltage-domain-support.patch
  ddb1db900c51a4fd914716e9b3697ebeb7f1d06efc70375547bb2fdd7c147bcb  0003-feat-rockchip-support-SCMI-voltage-domain.patch
  03f235112b212719cb3bfc3aeb34b7f3eebc09b7585528a52bc71e892e49d15d  0004-feat-rockchip-add-SPI-driver.patch
  88e20932fc3a5d2b98e239b87d47251c9ff5bccbdcda62fa9c3533b69926bbf7  0005-feat-rockchip-add-RK806-PMIC-driver.patch
  5d213093f97d84a6ab0edeee194f65257502b9a692854a8d6accfdbae335687e  0006-feat-rk3588-initial-support-for-SCMI-voltage-domain.patch
  8b083ac5eb5f352d018e2e44df0e3f8189cc6a16e59e150b227cf2bfccbfd5e9  0007-feat-rk3588-add-SCMI_CCLK_EMMC.patch
  1f50d6dce43dc2bb45f4532d5f0a2899496816be5072a0020ba441bd4b06b9e3  0008-feat-rk3588-introduce-SD-MMC-Control-Service.patch
  c4e4cf827a15f72e92dcd64255637f973134d90daa504c1e27ceed34859cb28d  0009-feat-rk3588-add-TRNG-support.patch
# BL31 segments
  126976  bl31_0x00040000.bin
  9193  bl31_0x0005f000.bin
  0  bl31_0x000f0000.bin
  8192  bl31_0xff100000.bin
# edk2 flags
  -D SECURE_BOOT_ENABLE=TRUE -D DEFAULT_KEYS=TRUE -D PK_DEFAULT_FILE=keys/org_pk.cer -D KEK_DEFAULT_FILE1=keys/org_kek.cer -D DB_DEFAULT_FILE1=keys/org_db.cer -D KEK_DEFAULT_FILE2=keys/ms_kek.cer -D DB_DEFAULT_FILE2=keys/ms_uefi_ca.cer -D SECURE_BOOT_ENROLL_DEFAULTS=TRUE --pcd gRockchipTokenSpaceGuid.PcdNetworkStackPxeBootEnabledDefault=FALSE --pcd gRockchipTokenSpaceGuid.PcdNetworkStackHttpBootEnabledDefault=FALSE -D RK_X86_EMULATOR_ENABLE=FALSE -D RK_AMD_GOP_ENABLE=FALSE
# Secure Boot: SECUREBOOT_TRUST=microsoft
  subject=CN=harmacolindor.com Secure Boot PK
  sha256 Fingerprint=D2:9D:B6:21:6B:2A:B6:29:AF:8C:99:E9:BC:77:59:05:79:A2:81:28:7E:5F:E1:09:C9:2C:80:CC:56:51:59:33
  subject=CN=harmacolindor.com Secure Boot KEK
  sha256 Fingerprint=E5:E1:D4:12:6C:0B:34:A3:34:80:9B:66:A9:F0:62:BE:97:F9:BA:58:62:DA:51:E0:1E:17:ED:D8:30:BE:BB:50
  subject=CN=harmacolindor.com Secure Boot signing key
  sha256 Fingerprint=B7:5A:13:06:EF:A1:1C:2D:E0:7C:64:B5:08:9C:65:53:E1:DB:CF:B8:C0:4D:91:F9:0B:AF:84:6F:91:11:A8:2D
# image
  1703a9d2b7136b82b7fe1eee1be5ca550cb99f8475bb3dd126deb97f4cae7b04  rock-5b_UEFI_Release_824e6c12168a+harma.enforced.rca3b87f7.img
  c02c2207f7a934924e6125fe971fdf49e201058adae21f9d86426ce6877c97a4  rock-5b-secureboot.img (padded, as shipped)

== rock-5b-nosecureboot.img from rock-5b_UEFI_Release_824e6c12168a+harma.not-enforced.r85bd984d.img (6446592 bytes, zero-padded to 0x7C0000)
device        rock-5b
edk2-rk3588   824e6c12168a51cf72470fb43da60642e835198f
org           harma
secure-boot   disabled
recipe        85bd984d
tf-a          51d8794cc2b52e8df842ab2d2b6e1326a80da735 (+ scripts/firmware/tfa-patches)
# submodules
  +51d8794cc2b52e8df842ab2d2b6e1326a80da735 arm-trusted-firmware (v2.12.0-4513-g51d8794cc)
  +1826bba6fb1c8c0b6d845f8308590dcfd1f7f859 devicetree/mainline/upstream (v7.2-dts)
  +2970e5699ba6267f3384ffab20f96647578aebc8 edk2 (edk2-stable201903-10800-g2970e5699b)
  +7ac12d81e02b323bffdf1ef3c188ea33c2185c91 edk2-non-osi (heads/master)
  +2db572db2fead29fbb4b622b0ea954b2f2f93a62 edk2-platforms (20260316-before-platform-removals-213-g2db572db2f)
  +3e288fe814e059dd06833495f845cab04ac20a5c misc/rkbin (heads/master)
# inputs (sha256)
  keys/a1117f516a32cefcba3f2d1ace10a87972fd6bbe8fe0d0b996e09e65d802a503  ms_kek.cer
  keys/48e99b991f57fc52f76149599bff0a58c47154229b9f8d603ac40d3500248507  ms_uefi_ca.cer
  keys/b75a1306efa11c2de07c64b5089c6553e1dbcfb8c04d91f90baf846f9111a82d  org_db.cer
  keys/e5e1d4126c0b34a334809b66a9f062be97f9ba5862da51e01e17edd830bebb50  org_kek.cer
  keys/d29db6216b2ab629af8c99e9bc77590579a281287e5fe109c92c80cc56515933  org_pk.cer
  8eb05757435dc6f866d0dca68dde1d6295108ff1ea09dce1271333da200b4a80  edk2-rockchip/Platform/Radxa/Drivers/LogoDxe/Logo.bmp
# patches
  9950df0fa678c0119c1544ae6714c93d6e9c0c6cd748283ec78d9118a816cbdd  0001-fit-drop-never-executed-optee.patch
  be747a990b5d34b34ae2cc01be83c5a257f3c02e3c3bb8387ad02fb8b141d143  0002-fit-bl31-rw-segment-at-mainline-address.patch
  4e563ddc6f5c18cf233b0df6a3c3d4426544eb2564315caa29c3b293dc7e8282  0003-port-to-edk2-stable202608.patch
  5b0938fccd54e7c45747eac5e939c19f37d427f7c1d4eb4e4b63303ad21ebdc2  0004-secure-boot-enroll-default-keys.patch
  b7a53b8b1e81feaf1c3c399caa3f687eed642fa81b3154123d0ea24746254184  0001-feat-rk3588-add-doorbell-interrupt-support-to-SCMI.patch
  0d120c4beaad2088349b6cdc631eca7e5d66f160a78e5fbbbcb918082169ab39  0002-feat-scmi-add-voltage-domain-support.patch
  ddb1db900c51a4fd914716e9b3697ebeb7f1d06efc70375547bb2fdd7c147bcb  0003-feat-rockchip-support-SCMI-voltage-domain.patch
  03f235112b212719cb3bfc3aeb34b7f3eebc09b7585528a52bc71e892e49d15d  0004-feat-rockchip-add-SPI-driver.patch
  88e20932fc3a5d2b98e239b87d47251c9ff5bccbdcda62fa9c3533b69926bbf7  0005-feat-rockchip-add-RK806-PMIC-driver.patch
  5d213093f97d84a6ab0edeee194f65257502b9a692854a8d6accfdbae335687e  0006-feat-rk3588-initial-support-for-SCMI-voltage-domain.patch
  8b083ac5eb5f352d018e2e44df0e3f8189cc6a16e59e150b227cf2bfccbfd5e9  0007-feat-rk3588-add-SCMI_CCLK_EMMC.patch
  1f50d6dce43dc2bb45f4532d5f0a2899496816be5072a0020ba441bd4b06b9e3  0008-feat-rk3588-introduce-SD-MMC-Control-Service.patch
  c4e4cf827a15f72e92dcd64255637f973134d90daa504c1e27ceed34859cb28d  0009-feat-rk3588-add-TRNG-support.patch
# BL31 segments
  126976  bl31_0x00040000.bin
  9193  bl31_0x0005f000.bin
  0  bl31_0x000f0000.bin
  8192  bl31_0xff100000.bin
# edk2 flags
  -D SECURE_BOOT_ENABLE=TRUE -D DEFAULT_KEYS=TRUE -D PK_DEFAULT_FILE=keys/org_pk.cer -D KEK_DEFAULT_FILE1=keys/org_kek.cer -D DB_DEFAULT_FILE1=keys/org_db.cer -D KEK_DEFAULT_FILE2=keys/ms_kek.cer -D DB_DEFAULT_FILE2=keys/ms_uefi_ca.cer -D SECURE_BOOT_ENROLL_DEFAULTS=FALSE --pcd gRockchipTokenSpaceGuid.PcdNetworkStackPxeBootEnabledDefault=FALSE --pcd gRockchipTokenSpaceGuid.PcdNetworkStackHttpBootEnabledDefault=FALSE -D RK_X86_EMULATOR_ENABLE=FALSE -D RK_AMD_GOP_ENABLE=FALSE
# Secure Boot: SECUREBOOT_TRUST=microsoft
  subject=CN=harmacolindor.com Secure Boot PK
  sha256 Fingerprint=D2:9D:B6:21:6B:2A:B6:29:AF:8C:99:E9:BC:77:59:05:79:A2:81:28:7E:5F:E1:09:C9:2C:80:CC:56:51:59:33
  subject=CN=harmacolindor.com Secure Boot KEK
  sha256 Fingerprint=E5:E1:D4:12:6C:0B:34:A3:34:80:9B:66:A9:F0:62:BE:97:F9:BA:58:62:DA:51:E0:1E:17:ED:D8:30:BE:BB:50
  subject=CN=harmacolindor.com Secure Boot signing key
  sha256 Fingerprint=B7:5A:13:06:EF:A1:1C:2D:E0:7C:64:B5:08:9C:65:53:E1:DB:CF:B8:C0:4D:91:F9:0B:AF:84:6F:91:11:A8:2D
# image
  928c106ce09ef4cf26cbdeba48d90466187a684df59cf52cdfcb78cba8a6ae55  rock-5b_UEFI_Release_824e6c12168a+harma.not-enforced.r85bd984d.img
  ce08f74c795ff104b5d7458f76dbf36277796df3c14b3e6abc8c8a75852f6ad6  rock-5b-nosecureboot.img (padded, as shipped)

